COMMUNITY EDITION · EARLY ACCESS

Run Attestree free on your own fleet.

The Community Edition is the full platform, self-hosted with docker compose up — free for up to 200 Windows endpoints. No Azure, no Entra. First endpoint reconciled in five minutes.

Request early access

Early access — request access rather than a public download right now. Free up to 200 endpoints.

COMMUNITY vs COMMERCIAL

Run it: docker compose up; Dedicated instance, your Azure subscription
Identity: Local users, roles, TOTP MFA; Entra SSO, every tier
Endpoints: Up to 200; Set by your licence
Audit signing: Local file-backed key; Azure Key Vault
Price: Free; Commercial

WHAT YOU GET, FREE

The same product, scaled down.

One inventory across your managers

See what is actually installed across your fleet — winget and Chocolatey managed under one control plane, Scoop and uninstall entries inventoried; more package managers on the roadmap. Per-user installs are attributed to the user who actually has them, not flattened into a machine row.

Ring-promoted upgrades

Deploy, upgrade, and roll back in rings (canary → pilot → broad); rolling back makes the ring’s previous version current again. A detector that proposes a rollback when a rollout starts failing is built and ships switched off, and acting on a confirmed proposal is still being finished. The agent even ships its own updates through the same rings. Opt in and allow upstream egress, and new winget versions are ingested, detonated and promoted ring by ring with no click per version — halting on its own when the publisher’s signing certificate changes or an installer turns up unsigned.

SBOM + attestation, free

Attach a Hyper-V or Proxmox/KVM host and every winget package you ingest is detonated in a real sandbox, with a Syft SBOM and an attestation recorded against its installer’s SHA-256. Endpoints install only from your own feed, pinned to the SHA-256 you approved, and the feed serves the attested installer bytes itself, from local disk or Azure Blob.

Fleet reconciliation

Declarative desired state; drift surfaces as telemetry. The full control plane, self-hosted — including the operational controls: pause or abort a live agent rollout, tune ring soak floors, decommission an endpoint and revoke its token, all in-product.

No Azure, no Entra

Local accounts with real access control: four roles (admin, catalog author, auditor, read-only) enforced at the policy layer, TOTP two-factor with recovery codes, and break-glass recovery if you lock yourself out. Runs on a single box with Docker, nothing in the cloud unless you opt in.

Private by default

No telemetry: the platform never phones home. No licence check, no usage analytics, no crash reporting.

QUICKSTART

From zero to first endpoint in five minutes.

One image, a Postgres sidecar, and a Docker volume. No subscription, no cloud account. Pull it, bring it up, enroll your first endpoint.

~/attestree

# Community Edition — early access (pre-GA)
$ cp .env.example .env
#   set POSTGRES_PASSWORD + WEP_PUBLIC_BASE_URI — boot fails without them
$ docker compose up -d
#   platform + Postgres sidecar, no Azure required
#   open http://localhost:18080  →  first-run setup creates your admin
#   generate an enrollment token, drop it on an endpoint
#   first endpoint reconciled in ~5 minutes

Honest about the audit posture. The Community Edition signs its audit chain with a local, file-backed key. It exports real evidence bundles that verify offline — but the key's custody is not hardware-attested, and the console says so on the export itself, so this is not built for regulatory submission. Need the key off the box? The commercial tier keeps it in a Key Vault in your own Azure subscription; HSM-backed custody and an on-prem appliance are on the roadmap.

Compliance tiers

JOIN IN

A small community, building in the open.

GitHub

Star the repo, file issues, and ask questions in Discussions. The Apache-2.0 installer shim is open source.

Repository goes public at launch

Roadmap

See what is next for the winget gate, inventory and transforms.

View the roadmap

Discord

Real-time chat opens once the community grows past the first wave. For now, Discussions is home.

Coming soon

Outgrow 200 endpoints?

The commercial tier lifts the cap to what your licence states and adds Entra SSO, a dedicated instance in your own Azure subscription, and a signing key held in a Key Vault there — the same product. Moving over means re-enrolling your endpoints against the new instance; your old audit bundles stay verifiable.

See pricing Request access